CVE-2026-93352

Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbidden_extensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits pht, which Apache executes as PHP via the default FilesMatch directive on Debian and Ubuntu systems. An attacker can upload a .pht file that passes all validation in MediaUploader::verifyExtension() and File::sanitizeFileName() because pht is not present in the blocklist, causing the file to be written to disk and executed as PHP when requested, enabling remote code execution with the privileges of the web server process.

• CWE-434

• https://github.com/plank/laravel-mediable/commit/8ddb0e5b300084e91ad2cb18a6e7bc768bb7b008
• https://github.com/plank/laravel-mediable/pull/396
• https://github.com/plank/laravel-mediable/releases/tag/7.0.2
• https://www.vulncheck.com/advisories/laravel-mediable-rce-via-pht-file-upload

Published

Sep 23, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93342MarketKing plugin for WordPress before 2.1.72 contains a mis…5.4
• CVE-2026-93343MarketKing plugin for WordPress before 2.1.72 contains a mis…6.5
• CVE-2026-93344MarketKing plugin for WordPress before 2.1.72 contains a mis…6.5
• CVE-2026-93345MikroTik RouterOS before 7.25beta4 contains an improper inpu…7.5
• CVE-2026-93349Frictionless through 5.20.0rc1 contains an OS command inject…8.8
• CVE-2026-9335A vulnerability in keras-team/keras versions <= 3.14.0 allow…6.5
• CVE-2026-93353copyparty contains a volume restriction bypass vulnerability…5.3
• CVE-2026-93354Taskview Community before 1.56.0 contains a missing authenti…8.1
• CVE-2026-9336IBM WebSphere Application Server 9.0, and 8.5 is vulnerable …7.5
• CVE-2026-93363The @payloadcms/storage-vercel-blob storage adapter for Payl…4.3
• CVE-2026-93364Bludit CMS through 3.22.0 contains a mass assignment vulnera…4.3
• CVE-2026-93365Bludit CMS through 3.22.0 contains a missing authorization v…6.5